Period-tracking app Maya shares users personal data with Facebook

Women health-focussed app Maya has shared sensitive data about the menstrual, emotional and sexual health of its users with Facebook, according to a report published by advocacy group Privacy International.

Maya, owned by New Delhi-based Sheroes, a women-only community platform, was found to be one of two apps that extensively shared sensitive personal data with third parties, including Facebook. Cyprus-based MIA was the other app.

Privacy International’s traffic analysis revealed that Maya informs Facebook when users open the app and starts sharing data with the social network even before the users agrees to its privacy policy, raising serious transparency concerns.

Like other menstruation apps, Maya gathers data about users’ intimate life - requesting information about when they had sex and whether it was protected, according to the report.

Sheroes told Privacy International it had removed the core Facebook software and the analytics software responsible for leaking the data and targeting ads at women. Sheroes founder Sairee Chahal did not immediately reply to phone calls and text messages.

“Confidentiality is at the heart of medical ethics and countries that have data protection laws traditionally have a separate regime for health data, which includes health data, which are considered sensitive data,” UK-based Privacy International said in the report.

The report said Maya asks users to enter how they feel and offers suggestions about the symptoms they might have and this information was shared with Facebook. It also shared details about a user’s moods with Facebook.

“There is a reason why advertisers are so interested in your mood; understanding when a person is in a vulnerable state of mind means you can strategically target them,” it stated. “Understanding people’s mood is an entry point for manipulating them.”

Privacy International said although Maya’s privacy policy says that no personal data is disclosed to advertisers, it then states that such data may be used “to comply with our advertisers’ wishes by displaying their advertisement to that target audience.” They don’t specify whether this involves health-related data.